toolroll 0.9.85 → 0.9.87

package/dist/operate.js

@@ -28,6 +28,8 @@ import { idleStorageSweep, sweepSchedule, sweepScheduleWords } from "./storage-s
 import { lastSweep, saveSweep, sweepDetails, sweepWords as storageSweepWords } from "./storage-sweep.js";
 import { removeShared, sharedDepsRoot, sharedUse, unusedShared } from "./shared-deps.js";
 import { cleanLandedBacklog, gitOf, landedBacklog, reconcileLanded, BACKLOG_DAYS } from "./landed-cleanup.js";
+import { accessOf, applyTidy, approverStandsNow, withinLens, familyRepoOf, releaseFactsFor, runTidy, tidyDays, tidyDigest, tidyGroups, tidyPreview, TIDY_DEFAULT_DAYS, TIDY_PASS_LIMIT } from "./tidy.js";
+import { personProof } from "./person-proof.js";
 import { RemoteMains } from "./remote-main.js";
 import { checkoutPlan, cleanCheckouts, discardCheckout, finishedCheckouts, slimKeptCheckouts, whyWords } from "./checkout-cleanup.js";
 import { closeOutCheckouts, closeOutRuns, stoppedWords } from "./run-closeout.js";
@@ -105,7 +107,8 @@ import { taskReviewBrief, renderReviewBrief } from "./task-review-brief.js";
 import { homedir, hostname } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { releaseStalledUpdate, waitingUpdate } from "./toolroll-update.js";
-import { openStore, openStoreNoMigrate, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
+import { dur } from "./design/kit.js";
+import { openStore, openStoreNoMigrate, archiveTaskFamily, restoreTaskFamily, shipChecksForTask, elapsedSeconds, CONCURRENT_WRITER_WAIT_MS, isDatabaseBusy, databasePath, BUILT_IN, parseCapabilityKey, verifiedAuthor, isDigestTime, predecessorWatches, RESULT_SCREENSHOTS, lifecycleOf, reportLifecycle, beatLifecycle, } from "./store.js";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { claimInstance, clearInstance, openInstanceSocket } from "./console-instance.js";
 import { authorizePlanUnderMode } from "./plan-auto.js";
@@ -273,7 +276,11 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         the lead passes it as --token, or TOOLROLL_LEAD_TOKEN, and its work pings nobody
   toolroll task ask <id> --person <name> --why "<text>"
                                         hand a task to a person: it pings them, and it is theirs
-  toolroll task list [--view <v>] [--limit <n>] [--cursor <c>]   paginated saved task status
+  toolroll task list [--view <v>] [--limit <n>] [--cursor <c>]   paginated saved task status (--view archived: put away)
+  toolroll task archive <id...> [--reason <why>]   put tasks away: out of every list, history kept (a person's act)
+  toolroll task restore <id...>      bring put-away tasks back exactly as they were
+  toolroll task tidy --preview [--days N]   what Put away old tasks would put away, and why (read-only)
+  toolroll task tidy --apply --digest <d> [--except <id,...>]   put away exactly that list
   toolroll task show <id>
   toolroll task wait <id> [--timeout <seconds>]
                                         wait for this attempt to finish or need a person
@@ -338,6 +345,7 @@ export const OPERATE_HELP = `toolroll — operating the queue
       [--anyway]                        merge without waiting for the full check
   toolroll task checks <id> [--level quick|full]
                                         run checks on the result's exact commit now
+  toolroll task ship <id>            its pull request's checks, each with its state and how long it took
   toolroll task add-tests <id>       file a small task to write tests for that change
   toolroll task revise <id> --feedback "requested change"
   toolroll assignment show <task>    root, current work and exact handoff
@@ -663,7 +671,7 @@ export const TASK_ACTIONS = [
     "add", "list", "show", "wait", "state", "block", "unblock", "next", "steer", "pause", "continue", "assign",
     "reopen", "scope", "approve", "hold", "unhold", "require", "requeue", "regate", "plan",
     "review", "accept", "repair", "route", "stop", "resume", "complete", "revise", "merge", "ask",
-    "checks", "add-tests",
+    "checks", "add-tests", "archive", "restore", "tidy", "ship",
 ];
 export const PUBLISH_ACTIONS = ["setup", "grant", "revoke", "status", "unblock", "rearm", "merge", "refire"];
 export const CONFIG_ACTIONS = ["show", "set", "clear"];
@@ -707,6 +715,8 @@ export const OPERATE_VALUE_FLAGS = new Set([
     "starter",
     // flows: templates, steps, scripts and cards.
     "template", "steps", "about", "language", "timeout-minutes", "body", "description", "zone", "option",
+    // task tidy --apply: the previewed tasks to leave out.
+    "except",
     "token-env", "after", "repair-max-attempts", "consumer", "batch", "feedback", "source", "view", "cursor", "why", "supersedes", "decision", "sessions", "timeout",
     // pings follow responsibility: replacements.
     "replaced-by", "replaces",
@@ -757,6 +767,8 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     "password-stdin",
     // task steer: pause the running Claude build, then send the note.
     "now",
+    // task tidy: look first (--preview), then put away exactly what was shown (--apply --digest).
+    "preview", "apply",
 ]);
 /** `project network` reads --remove <hosts> and --local any|none as values, where every other verb's --remove and
  * --local are switches. */
@@ -1564,6 +1576,8 @@ function claimCommand(positional, flags, context) {
             return fail(write, json, "claim", "sweep-limit", `its sweep already has ${result.limit} running at once — it starts when one finishes`, EXIT.refused, { sweep: result.sweep, limit: result.limit });
         if (result.reason === "watch-custody")
             return fail(write, json, "claim", "watch-custody", "This worker no longer holds the project; restart the watch", EXIT.refused);
+        if (result.reason === "archived")
+            return fail(write, json, "claim", "archived", `${id} is put away — restore it with \`toolroll task restore ${id}\` first`, EXIT.refused);
         if (result.reason === "draining")
             return fail(write, json, "claim", "draining", `Toolroll is restarting (draining): ${runner} takes no new work until it is back (by ${result.until})`, EXIT.refused, { until: result.until });
         return fail(write, json, "claim", result.reason, `held by ${result.by} until ${result.until}`, EXIT.refused, { holder: result.by, until: result.until });
@@ -3562,6 +3576,13 @@ async function reconcileCommand(flags, context) {
         remotes.close();
     }
     const landedGone = landed.steps.filter(one => one.outcome === "removed");
+    // Tidy (task-tidy.md): old routine runs a newer run replaces, release tasks already published or replaced, and CI
+    // notices main has fixed are put away, at most a bounded number a pass, each with its reason in the ledger.
+    let tidied = [];
+    try {
+        tidied = runTidy(store, clock(), releaseFactsFor(context.databaseFile), TIDY_PASS_LIMIT, { principal: "operator", repos: [repo], includeUnplaced: false });
+    }
+    catch { /* the next pass tries again */ }
     // Checkout cleanup (Settings → Storage): finished work's clean checkouts go as the setting says (by default when
     // the task is complete or cancelled); their branches stay. Each removal is in the ledger.
     // Completing or cancelling a task stops anything still running from its checkout first.
@@ -3605,6 +3626,7 @@ async function reconcileCommand(flags, context) {
         slimmed.slimmed.length === 0 &&
         landed.completed.length === 0 &&
         landedGone.length === 0 &&
+        tidied.length === 0 &&
         liveSwept.removed.length === 0;
     return succeed(write, json, "reconcile", {
         recovered,
@@ -3616,6 +3638,7 @@ async function reconcileCommand(flags, context) {
         processesStopped: [...closedRuns.map(one => ({ run: one.runId, pids: one.done.stopped.map(row => row.pid) })), ...closedCheckouts.map(one => ({ checkout: one.path, pids: one.done.stopped.map(row => row.pid) }))],
         checkoutsSlimmed: slimmed.slimmed.map(one => one.path),
         landed: { completed: landed.completed, steps: landed.steps },
+        tidied: tidied.map(one => ({ id: one.taskId, rule: one.rule, reason: one.reason })),
         liveViewsSwept: liveSwept.removed.length,
         retention: retention === null ? null : { counts: retention.counts, freedBytes: retention.freed },
         storageSweep: storageSwept,
@@ -3630,6 +3653,7 @@ async function reconcileCommand(flags, context) {
             ...closedRuns.map(one => `Run #${one.runId} ended; stopped ${stoppedWords(one.done)}.`),
             ...closedCheckouts.map(one => `${one.path}: its task finished; stopped ${stoppedWords(one.done)}.`),
             ...(landed.completed.length === 0 ? [] : [`Marked ${landed.completed.length} landed result(s) complete: ${landed.completed.join(", ")}.`]),
+            ...(tidied.length === 0 ? [] : [`Put away ${tidied.length} old task(s): ${tidied.map(one => one.taskId).join(", ")}.`]),
             ...(landedGone.length === 0 ? [] : [`Removed landed work: ${landedGone.filter(one => one.kind === "checkout").length} checkout(s), ${landedGone.filter(one => one.kind === "branch").length} local branch(es).`]),
             ...(slimmed.slimmed.length === 0 ? [] : [`Dropped dependencies and build output from ${slimmed.slimmed.length} kept checkout(s), about ${bytesWords(slimmed.slimmed.reduce((sum, one) => sum + one.bytes, 0))}.`]),
             ...(liveSwept.removed.length === 0 ? [] : [`Cleared ${liveSwept.removed.length} finished live view(s).`]),
@@ -4112,6 +4136,7 @@ async function requeueTask(positional, flags, context) {
             published: `${id}'s last result is published; revise it through its pull request`,
             // Only an Approve & build again asks for an exact build; the CLI never does.
             moved: `${id} changed since its page was read; read it again`,
+            archived: `${id} is put away — restore it with \`toolroll task restore ${id}\` first`,
         };
         return fail(write, json, "task requeue", result.reason, why[result.reason], EXIT.refused);
     }
@@ -8563,10 +8588,18 @@ function taskAction(action, rest, flags, context) {
             return addTask(rest, flags, context);
         case "checks":
             return runTaskChecks(rest, flags, context);
+        case "ship":
+            return taskShipCommand(rest, context);
         case "add-tests":
             return addTestsTask(rest, flags, context);
         case "list":
             return listTasks(flags, context);
+        case "archive":
+            return archiveTasksCommand(rest, flags, context);
+        case "restore":
+            return restoreTasksCommand(rest, flags, context);
+        case "tidy":
+            return tidyTasksCommand(rest, flags, context);
         case "show":
             return showTask(rest, context);
         case "wait":
@@ -8988,9 +9021,9 @@ function listTasks(flags, context) {
     const limit = rawLimit === undefined ? 40 : Number(rawLimit);
     if (wanted !== undefined && !STATES.includes(wanted))
         return fail(write, json, 'task list', 'usage', `--state takes one of ${STATES.join(', ')}`, EXIT.usage);
-    if (rawView !== undefined && !['all', 'needs-you', 'running', 'completed'].includes(rawView) ||
+    if (rawView !== undefined && !['all', 'needs-you', 'running', 'queued', 'completed', 'archived'].includes(rawView) ||
         !Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
-        return fail(write, json, 'task list', 'usage', '--view takes all, needs-you, running or completed; --limit takes 1–100', EXIT.usage);
+        return fail(write, json, 'task list', 'usage', '--view takes all, needs-you, running, queued, completed or archived; --limit takes 1–100', EXIT.usage);
     }
     // A remote person limited to some projects (remoteLensOf) pages and counts only theirs.
     const lens = context.principal?.lens ?? null;
@@ -9017,7 +9050,8 @@ function listTasks(flags, context) {
             write(wanted === undefined ? 'The task list is empty.' : `Nothing is ${wanted}.`);
         const width = Math.max(0, ...tasks.map(task => task.id.length));
         for (const task of tasks)
-            write(`  ${task.id.padEnd(width)}  ${task.status.label.padEnd(16)}  ${task.title}`);
+            write(task.archived === undefined ? `  ${task.id.padEnd(width)}  ${task.status.label.padEnd(16)}  ${task.title}`
+                : `  ${task.id.padEnd(width)}  ${'Archived'.padEnd(16)}  ${task.title} — by ${task.archived.byKind === 'tidy' ? 'tidy' : task.archived.by}: ${task.archived.reason}`);
         if (page.nextCursor !== null)
             write(`Next page: --cursor ${page.nextCursor}`);
         return EXIT.ok;
@@ -10149,6 +10183,8 @@ function describeApproveFailure(reason, id) {
     // Approval policy, phase 1: the lead's token (or a remote API token) proves a credential, not a person.
     if (reason === "machine-proof")
         return "only a person can approve this — approve it on the task page or from your paired chat";
+    if (reason === "archived")
+        return `${id} is put away — restore it with \`toolroll task restore ${id}\` first`;
     if (reason === "second-approver")
         return `your approval of ${id} is recorded; it is protected work, so a second person needs to approve it (toolroll task approve ${id} as them)`;
     if (reason === "no-approvers") {
@@ -12754,3 +12790,210 @@ export function consoleIdentitiesInBackground(identities, paths) {
 export function writeModelRow(store, proved, scope, knownProject, slot, to, now, extra = []) {
     return applyModelChoices(store, { scope, change: slot === null ? [] : [{ slot, to }], expected: null, strict: false, knownProject, extra }, { ...proved, live: () => true }, now);
 }
+/** Putting away and restoring are a person's acts (docs/plans/task-tidy.md): never the lead's token, never a remote
+ * API token, never a machine proof. Null when a person is acting. */
+function refuseMachineTidy(context, command, method) {
+    if (machineActing() || process.env["TOOLROLL_LEAD_TOKEN"] !== undefined || (method !== undefined && !personProof(method))) {
+        return fail(context.write, context.json, command, "person-only", "Only a person puts tasks away or restores them. Use the console or your own login.", EXIT.refused);
+    }
+    return null;
+}
+/** `toolroll task archive <id...> [--reason <text>]`: put tasks away by hand (v145). Each keeps its history, results and
+ * approvals; nothing can run, claim or approve it until it is restored. Credentialed, a person's act. */
+async function archiveTasksCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task archive";
+    const ids = [...new Set(positional)];
+    if (ids.length === 0 || ids.length > 100)
+        return fail(write, json, command, "usage", "`toolroll task archive <id...> [--reason <why>] --as <you> --token <t>` — 1 to 100 tasks", EXIT.usage);
+    const machine = refuseMachineTidy(context, command);
+    if (machine !== null)
+        return machine;
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    const acting = await askCredentials(flags, context);
+    // The password is proved against a project the person can see (the first task's); each task's own project is
+    // re-proved inside its put-away transaction.
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, firstVisibleRepo(store, acting.name, ids));
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, command, verified, "putting a task away takes `--as <you> --token <t>` — it is recorded against your name", ids[0]);
+    const personal = refuseMachineTidy(context, command, verified.method);
+    if (personal !== null)
+        return personal;
+    const reason = text(flags, "reason") ?? "Put away by hand";
+    const archived = [], refused = [];
+    for (const id of ids) {
+        const ref = store.lookupRef(id);
+        if (ref === null || store.getTask(id) === null || !store.accountCanAccess(acting.name, ref.repo)) {
+            refused.push({ id, reason: "unknown-task", message: `No task ${id}.` });
+            continue;
+        }
+        const done = archiveTaskFamily(store, id, { by: acting.name, byKind: "person", rule: null, reason }, clock(), { guard: refs => approverStandsNow(store, acting.name, familyRepoOf(store, refs)) });
+        if (done.ok)
+            archived.push({ id, versions: done.refs.length });
+        else
+            refused.push({ id, reason: done.reason, message: done.message });
+    }
+    const lines = () => [
+        ...archived.map(one => `Put away ${one.id}${one.versions > 1 ? ` (${one.versions} versions)` : ""}.`),
+        ...refused.map(one => `Not put away: ${one.message}`),
+        ...(archived.length === 0 ? [] : [`Restore with \`toolroll task restore ${archived.map(one => one.id).join(" ")}\`.`]),
+    ];
+    if (refused.length === 0)
+        return succeed(write, json, command, { archived, refused }, lines);
+    if (json)
+        return fail(write, json, command, refused[0].reason, refused[0].message, EXIT.refused, { archived, refused });
+    write(lines().join("\n"));
+    return EXIT.refused;
+}
+/** `toolroll task restore <id...>`: bring put-away tasks back exactly as they were (v145). Credentialed, a person's act. */
+async function restoreTasksCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task restore";
+    const ids = [...new Set(positional)];
+    if (ids.length === 0 || ids.length > 100)
+        return fail(write, json, command, "usage", "`toolroll task restore <id...> --as <you> --token <t>` — 1 to 100 tasks", EXIT.usage);
+    const machine = refuseMachineTidy(context, command);
+    if (machine !== null)
+        return machine;
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, firstVisibleRepo(store, acting.name, ids));
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, command, verified, "restoring takes `--as <you> --token <t>` — it is recorded against your name", ids[0]);
+    const personal = refuseMachineTidy(context, command, verified.method);
+    if (personal !== null)
+        return personal;
+    const restored = [], refused = [];
+    for (const id of ids) {
+        const ref = store.lookupRef(id);
+        if (ref === null || store.getTask(id) === null || !store.accountCanAccess(acting.name, ref.repo)) {
+            refused.push({ id, reason: "unknown-task", message: `No task ${id}.` });
+            continue;
+        }
+        const done = restoreTaskFamily(store, id, acting.name, clock(), refs => approverStandsNow(store, acting.name, familyRepoOf(store, refs)));
+        if (done.ok)
+            restored.push(id);
+        else
+            refused.push({ id, reason: done.reason, message: done.message });
+    }
+    const lines = () => [...restored.map(id => `Restored ${id}.`), ...refused.map(one => `Not restored: ${one.message}`)];
+    if (refused.length === 0)
+        return succeed(write, json, command, { restored, refused }, lines);
+    if (json)
+        return fail(write, json, command, refused[0].reason, refused[0].message, EXIT.refused, { restored, refused });
+    write(lines().join("\n"));
+    return EXIT.refused;
+}
+/** `toolroll task tidy --preview [--days N]` (read-only, no credential) and `toolroll task tidy --apply --digest <d>
+ * [--days N] [--except <id,...>]` (credentialed, a person's act): the console's Put away old tasks, word for word,
+ * with the same preview and digest. Apply puts away exactly what the preview with that digest showed. */
+async function tidyTasksCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task tidy";
+    const preview = flag(flags, "preview"), apply = flag(flags, "apply");
+    const days = tidyDays(text(flags, "days"));
+    const digest = text(flags, "digest");
+    const except = (text(flags, "except") ?? "").split(",").map(one => one.trim()).filter(one => one !== "");
+    const usage = "`toolroll task tidy --preview [--days N]`, then `toolroll task tidy --apply --digest <d> [--days N] [--except <id,...>]`";
+    if (positional.length > 0 || preview === apply || days === null || (preview && (digest !== undefined || except.length > 0)) || (apply && digest === undefined))
+        return fail(write, json, command, "usage", usage, EXIT.usage);
+    const releases = releaseFactsFor(context.databaseFile);
+    // One scope for the preview and the apply: `--as <you>` previews exactly your projects (no password: it reads), and
+    // the apply reads the same person's projects, so an unchanged list keeps its digest.
+    // Whose lists: `--as <you>`, else this machine's saved login (`toolroll up`), else everything (an unrestricted
+    // person's list; a person limited to some projects previews with --as).
+    const previewAs = text(flags, "as") ?? readLoginFile(join(dirname(context.databaseFile), UP_LOGIN_FILE))?.name;
+    const daysArg = `${days === TIDY_DEFAULT_DAYS ? "" : ` --days ${days}`}${previewAs === undefined ? "" : ` --as ${previewAs}`}`;
+    // `--as` only ever narrows: the named person's projects within the caller's own lens, never beyond it.
+    const lens = context.principal?.lens ?? null;
+    const own = { principal: "operator", repos: lens, includeUnplaced: lens === null };
+    const access = previewAs !== undefined ? withinLens(accessOf(store, previewAs), lens) : own;
+    if (preview) {
+        const items = tidyPreview(store, clock(), { releases, days, access });
+        const shown = tidyDigest(items, days);
+        const groups = tidyGroups(items, days);
+        const next = `toolroll task tidy --apply --digest ${shown}${daysArg}`;
+        return succeed(write, json, command, { preview: true, days, digest: shown, count: items.length, groups, next: items.length === 0 ? null : next,
+            ...(releases.problem === null ? {} : { releasesSkipped: releases.problem }) }, () => items.length === 0
+            ? ["Nothing to put away."]
+            : [`Put away old tasks: ${items.length} task${items.length === 1 ? "" : "s"}.`,
+                ...groups.flatMap(group => ["", `${group.label} (${group.items.length})`, ...group.items.map(one => `  ${one.taskId}  ${one.reason}${one.members.length > 1 ? ` (${one.members.length} versions)` : ""}`)]),
+                ...(releases.problem === null ? [] : ["", `Release tasks were left out: ${releases.problem}.`]),
+                "", `To put these away, run: ${next}`, "Leave some out with --except <id,...>.",
+                ...(previewAs === undefined ? ["Limited to some projects? Preview with --as <you> so the list is yours."] : [])]);
+    }
+    const machine = refuseMachineTidy(context, command);
+    if (machine !== null)
+        return machine;
+    const demo = refuseDemo(context, command);
+    if (demo !== null)
+        return demo;
+    const acting = await askCredentials(flags, context);
+    const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token, firstVisibleRepo(store, acting.name, []));
+    if (acting === null || !verified?.ok)
+        return refuseApprover(context, command, verified, "putting tasks away takes `--as <you> --token <t>` — it is recorded against your name", undefined);
+    const personal = refuseMachineTidy(context, command, verified.method);
+    if (personal !== null)
+        return personal;
+    // The person's own view of the lists, from the verified credential (never a flag), within the caller's lens: the
+    // same scope `--preview --as <them>` read.
+    const mine = withinLens(accessOf(store, acting.name), lens);
+    const shownItems = tidyPreview(store, clock(), { releases, days, access: mine });
+    const only = except.length === 0 ? null : shownItems.map(one => one.taskId).filter(id => !except.includes(id));
+    if (except.some(id => !shownItems.some(one => one.taskId === id)))
+        return fail(write, json, command, "outside", "--except names a task that isn't in the list. Check it again with --preview.", EXIT.refused);
+    const done = applyTidy(store, clock(), { by: acting.name, days, digest: digest, only, releases, access: mine });
+    if (!done.ok) {
+        const again = `toolroll task tidy --apply --digest ${done.digest}${daysArg}`;
+        return fail(write, json, command, done.reason, done.reason === "changed" ? `${done.message} Look again with \`toolroll task tidy --preview${daysArg}\`.` : done.message, EXIT.refused, { digest: done.digest, count: done.items.length, ...(done.reason === "changed" ? { next: done.items.length === 0 ? null : again } : {}) });
+    }
+    return succeed(write, json, command, { archived: done.archived.map(one => ({ id: one.taskId, rule: one.rule, reason: one.reason })), skipped: done.skipped }, () => [
+        `Put away ${done.archived.length} task${done.archived.length === 1 ? "" : "s"}.`,
+        ...done.skipped.map(one => `Not put away: ${one.message}`),
+        "Find them with `toolroll task list --view archived`; bring one back with `toolroll task restore <id>`.",
+    ]);
+}
+/** The project a put-away or restore proves the person's password against: the first named task's, when they can see
+ * it; otherwise the first project they can see at all (null when none: an unrestricted person, or none to prove). */
+function firstVisibleRepo(store, name, ids) {
+    for (const id of ids) {
+        const repo = store.lookupRef(id)?.repo ?? null;
+        if (repo !== null && store.accountCanAccess(name, repo))
+            return repo;
+    }
+    return store.accountCanAccess(name, null) ? null : store.knownRepos().find(repo => store.accountCanAccess(name, repo)) ?? null;
+}
+/** The check states as `task ship` says them. */
+const SHIP_CHECK_WORDS = { queued: "queued", running: "running", passed: "passed", failed: "failed", skipped: "skipped", cancelled: "cancelled", neutral: "neutral" };
+/**
+ * `toolroll task ship <task>` (read-only) — the task's pull request checks as the plane last observed them for that
+ * head (store.ts ci_check, v146): each check's state and how long it took, the Ship view's own facts.
+ */
+function taskShipCommand(positional, context) {
+    const { store, write, json } = context;
+    const command = "task ship";
+    const id = positional[0];
+    if (id === undefined || positional.length > 1)
+        return fail(write, json, command, "usage", "`toolroll task ship <task>`", EXIT.usage);
+    const ref = store.lookupRef(id);
+    const lens = context.principal?.lens ?? null;
+    // A task outside the caller's projects is no task here, the same answer as one that doesn't exist.
+    if (ref === null || store.getTask(id) === null || (lens !== null && (ref.repo === null || !lens.includes(ref.repo))))
+        return fail(write, json, command, "unknown-task", `no task \`${id}\``, EXIT.refused);
+    const ship = shipChecksForTask(store, id);
+    if (ship === null)
+        return fail(write, json, command, "no-pull-request", `${id} has no pull request with observed checks yet`, EXIT.refused);
+    const now = (context.clock ?? (() => context.now))();
+    const checks = ship.checks.map(one => ({ ...one, seconds: elapsedSeconds(one.startedAt, one.completedAt, now) }));
+    const passed = checks.filter(one => one.state === "passed").length;
+    // The overall answer is the observation's own (the one merges read), never a sum of the rows.
+    const overall = ship.observed === "failing" ? "failing" : ship.observed === "passing" ? "passing" : ship.observed === "running" ? "running" : "not read";
+    return succeed(write, json, command, { task: id, pullRequest: ship.prNumber, githubRepo: ship.githubRepo, head: ship.headSha, observedAt: ship.observedAt, status: ship.observed, checks }, () => [
+        `Pull request #${ship.prNumber} (${ship.githubRepo}) at ${ship.headSha.slice(0, 7)}: checks ${overall} · ${passed} of ${checks.length} passed`,
+        ...checks.map(one => `  ${(one.workflow === null ? one.name : `${one.workflow} / ${one.name}`).padEnd(32)} ${(SHIP_CHECK_WORDS[one.state] ?? one.state).padEnd(9)} ${one.seconds === null ? "–" : dur(one.seconds)}`),
+    ]);
+}

package/dist/passwordless.d.ts

@@ -20,4 +20,4 @@ export declare const passwordlessOn: (store: Store) => boolean;
 export declare function setPasswordless(store: Store, on: boolean, by: string, now: Date): {
     changed: boolean;
 };
-export declare const PASSWORDLESS_TRADE = "Anyone holding a signed-in browser \u2014 an unlocked laptop, a phone, a stolen session \u2014 can then do everything you can without a second check. Signing in, session limits (12 hours idle, 7 days), signing out and ending sessions remain your protection. Creating or widening a way in (passwords, sign-in methods, API tokens, connected apps, people, workers, chat pairing, webhook secrets) still asks for your password.";
+export declare const PASSWORDLESS_TRADE = "Anyone holding a signed-in browser \u2014 an unlocked laptop, a phone, a stolen session \u2014 can then do everything you can without a second check. Signing in, session limits (12 hours idle, 7 days), signing out and ending sessions remain your protection. Creating or widening a way in (passwords, sign-in methods, API tokens, connected apps, people, workers, chat pairing, webhook secrets), or widening what a project's builds and checks reach (its network, where builds write, its home folder and its check access), still asks for your password.";

package/dist/passwordless.js

@@ -23,4 +23,4 @@ export function setPasswordless(store, on, by, now) {
     store.bumpWake();
     return { changed: true };
 }
-export const PASSWORDLESS_TRADE = "Anyone holding a signed-in browser — an unlocked laptop, a phone, a stolen session — can then do everything you can without a second check. Signing in, session limits (12 hours idle, 7 days), signing out and ending sessions remain your protection. Creating or widening a way in (passwords, sign-in methods, API tokens, connected apps, people, workers, chat pairing, webhook secrets) still asks for your password.";
+export const PASSWORDLESS_TRADE = "Anyone holding a signed-in browser — an unlocked laptop, a phone, a stolen session — can then do everything you can without a second check. Signing in, session limits (12 hours idle, 7 days), signing out and ending sessions remain your protection. Creating or widening a way in (passwords, sign-in methods, API tokens, connected apps, people, workers, chat pairing, webhook secrets), or widening what a project's builds and checks reach (its network, where builds write, its home folder and its check access), still asks for your password.";

package/dist/people-audit-ui.d.ts

@@ -1,7 +1,8 @@
 import { type AuditAction } from "./remote-audit.js";
 import type { ApiTokenRow } from "./store.js";
 import { type Html } from "./html.js";
-export declare const PEOPLE_AUDIT_CSS: string;
+/** The old look; the page is built from the kit now. Kept for chrome.ts, which still concatenates it. */
+export declare const PEOPLE_AUDIT_CSS = "";
 export type PersonAuditView = {
     name: string;
     tokens: readonly ApiTokenRow[];

package/dist/people-audit-ui.js

@@ -3,36 +3,38 @@
  * (remote-audit.ts). A token's name filters the actions to it (`token-name`: a `token` query is always refused). Read-only: making, revoking and rotating tokens stay
  * in Settings → Sessions & tokens. Never a token's secret or a ledger line's raw detail.
  */
+import { settingsSubPage } from "./settings-groups-ui.js";
 import { basename } from "node:path";
 import { tokenStatus } from "./remote-audit.js";
-import { html } from "./html.js";
+import { html, joinHtml } from "./html.js";
+import { acts, btn, chip, note, settingsRecord, settingsSection } from "./server/kit.js";
 const stamp = (value) => `${value.slice(0, 16).replace("T", " ")} UTC`;
-export const PEOPLE_AUDIT_CSS = `.person-audit{max-width:820px;min-width:0;overflow-wrap:anywhere}.person-audit h2{font-size:1.05rem;margin:1.25rem 0 8px}` +
-    `.person-audit .rows{display:grid;border:1px solid var(--so-line);border-radius:10px;overflow:hidden}.person-audit .row-item{padding:10px 14px;border-bottom:1px solid var(--so-line);min-width:0}` +
-    `.person-audit .row-item:last-child{border-bottom:0}.person-audit .row-item p{margin:0}.person-audit .row-item .meta{font-size:.85rem}` +
-    `.person-audit a{display:inline-flex;align-items:center;min-height:44px}.person-audit .row-item a{min-height:32px}.person-audit a:focus-visible{outline:2px solid var(--so-accent);outline-offset:2px;border-radius:4px}` +
-    `.person-audit .outcome{display:inline-block;font-size:.8rem;font-weight:600;padding:1px 8px;border-radius:999px;margin-right:8px}` +
-    `.person-audit .outcome-ok{background:var(--so-success-soft);color:var(--so-success)}.person-audit .outcome-refused{background:var(--so-warning-soft);color:var(--so-ink)}` +
-    `.person-audit .outcome-error{background:var(--so-danger-soft);color:var(--so-danger)}` +
-    `@media(max-width:600px){.person-audit .row-item a{min-height:44px}}`;
+/** The old look; the page is built from the kit now. Kept for chrome.ts, which still concatenates it. */
+export const PEOPLE_AUDIT_CSS = "";
 export const personHref = (name, more = {}) => `/people?${new URLSearchParams({ person: name, ...more }).toString()}`;
 export function personAuditHtml(view) {
-    const tokens = view.tokens.length === 0 ? html `<p class="meta">No API tokens.</p>` : html `<div class="rows">${view.tokens.map(one => {
-        const status = tokenStatus(one, view.now);
-        return html `<div class="row-item" data-token-name="${one.name}"><p><a href="${personHref(view.name, { "token-name": one.name })}">${one.name}</a></p>\
-<p class="meta">${status === "active" ? "Active" : status === "expired" ? "Expired" : "Revoked"} · ${one.access === "act" ? "Can act" : "Read only"} · \
-last used ${one.lastUsedAt === null ? "never" : stamp(one.lastUsedAt)}</p></div>`;
-    })}</div>`;
-    const filtered = view.token === null ? "" : html `<p class="meta">With ${view.token}</p><p><a href="${personHref(view.name)}">All tokens</a></p>`;
-    const actions = view.actions.length === 0 ? html `<p class="meta">No remote actions${view.token === null ? "" : " with this token"}.</p>` : html `<div class="rows">${view.actions.map(actionHtml)}</div>`;
-    const older = view.nextCursor === null ? "" : html `<p><a href="${personHref(view.name, { ...(view.token === null ? {} : { "token-name": view.token }), before: view.nextCursor })}">Older actions</a></p>`;
-    return html `<p><a href="/people">People</a></p><h1>${view.name}</h1><section class="person-audit"><h2>API tokens</h2>${tokens}\
-<h2>Remote activity</h2>${filtered}${actions}${older}</section>`;
+    const tokens = settingsSection({ id: "person-tokens", title: "API tokens", lead: "Make, revoke and rotate tokens in Sessions and tokens.",
+        body: view.tokens.length === 0 ? note("No API tokens.") : joinHtml(view.tokens.map(one => {
+            const status = tokenStatus(one, view.now);
+            return settingsRecord({
+                title: html `<a class="k-link" href="${personHref(view.name, { "token-name": one.name })}">${one.name}</a>`,
+                sub: `${status === "active" ? "Active" : status === "expired" ? "Expired" : "Revoked"} · ${one.access === "act" ? "Can act" : "Read only"} · last used ${one.lastUsedAt === null ? "never" : stamp(one.lastUsedAt)}`,
+                attrs: { "data-token-name": one.name },
+            });
+        })) });
+    const filtered = view.token === null ? undefined : btn("All tokens", { sm: true, variant: "ghost", href: personHref(view.name) });
+    const older = view.nextCursor === null ? "" : acts(btn("Older actions", { sm: true, href: personHref(view.name, { ...(view.token === null ? {} : { "token-name": view.token }), before: view.nextCursor }) }));
+    const activity = settingsSection({ id: "person-activity", title: "Remote activity", ...(view.token === null ? {} : { state: ` · with ${view.token}` }), ...(filtered ? { right: filtered } : {}),
+        lead: "What this person did through the toolroll command and agents (MCP), newest first.",
+        body: joinHtml([view.actions.length === 0 ? note(`No remote actions${view.token === null ? "" : " with this token"}.`) : joinHtml(view.actions.map(actionHtml)), older]) });
+    return settingsSubPage("access", view.name, joinHtml([note(html `<a class="k-link" href="/people">All people</a>`), tokens, activity]));
 }
 function actionHtml(action) {
-    const label = action.outcome === "ok" ? "OK" : action.outcome === "refused" ? "Refused" : "Error";
+    const outcome = action.outcome === "ok" ? chip("OK", "done") : action.outcome === "refused" ? chip("Refused", "") : chip("Error", "failed");
     const detail = [stamp(action.at), action.token ?? "unknown token", action.source === "mcp" ? "Agent (MCP)" : "CLI",
         ...(action.repo === null ? [] : [basename(action.repo)]), ...(action.reason === null ? [] : [action.reason])];
-    return html `<div class="row-item" data-action="${action.id}"><p><span class="outcome outcome-${action.outcome}">${label}</span>${action.name}\
-${action.taskId === null ? "" : html ` · <a href="/t/${encodeURIComponent(action.taskId)}">${action.taskId}</a>`}</p><p class="meta">${detail.join(" · ")}</p></div>`;
+    return settingsRecord({
+        title: html `${outcome} ${action.name}${action.taskId === null ? "" : html ` · <a class="k-link" href="/t/${encodeURIComponent(action.taskId)}">${action.taskId}</a>`}`,
+        sub: detail.join(" · "), attrs: { "data-action": action.id },
+    });
 }

package/dist/policy-ui.d.ts

@@ -7,7 +7,8 @@
 import { type Html } from "./html.js";
 import type { LedgerEntry } from "./action-ledger.js";
 import { type SavedPolicy } from "./policy.js";
-export declare const POLICY_CSS: string;
+/** The old look; the page is built from the kit now. Kept for chrome.ts, which still concatenates it. */
+export declare const POLICY_CSS = "";
 export type PolicyView = {
     policy: SavedPolicy;
     history: LedgerEntry[];
@@ -15,7 +16,7 @@ export type PolicyView = {
     /** The project tools here, as a hint for the tools list. */
     toolNames: string[];
 };
-export declare function policyHtml(view: PolicyView, notice: {
+export declare function policyHtml(view: PolicyView, outcome: {
     said?: string | null;
     problem?: string | null;
 }): Html;

package/dist/policy-ui.js

@@ -4,33 +4,39 @@
  * action ledger. Anyone signed in reads it; an instance operator changes it
  * with their password.
  */
-import { html, postForm, reauth } from "./html.js";
+import { html, joinHtml } from "./html.js";
 import { whenUtc } from "./when-html.js";
 import { LEVEL_HINTS, LEVEL_NAMES, PERMISSION_LEVELS, POLICY_PROVIDERS, PROVIDER_NAMES, policyParts } from "./policy.js";
-export const POLICY_CSS = `.policy{max-width:720px;min-width:0}.policy dl{display:grid;grid-template-columns:max-content minmax(0,1fr);gap:6px 16px;margin:12px 0 0;font-size:.875rem}` +
-    `.policy dt{color:var(--muted-foreground)}.policy dd{margin:0;overflow-wrap:anywhere}.policy fieldset{border:0;padding:0;margin:20px 0 0;min-width:0}` +
-    `.policy legend{font-weight:600;font-size:.875rem;margin-bottom:8px}.policy legend{padding:0}.policy .providers{display:grid;grid-template-columns:repeat(auto-fill,minmax(132px,1fr));gap:0 16px}.policy .providers label{display:flex;gap:8px;align-items:center;min-height:44px;margin:0;padding:0;font-weight:400}` +
-    `.policy .choice{display:grid;grid-template-columns:auto minmax(0,1fr);gap:10px;align-items:start;margin:0 0 10px;font-weight:400}.policy .choice input{margin:.2rem 0 0}` +
-    `.policy .choice strong{display:block;font-size:.875rem;font-weight:500}.policy .choice small,.policy .hint{display:block;color:var(--muted-foreground);font-size:.8125rem;margin-top:2px}` +
-    `.policy textarea{width:100%;min-height:72px;font-family:var(--font-mono);font-size:.8125rem;box-sizing:border-box}.policy .step-up{margin-top:18px}.policy button[type=submit]{margin-top:14px}` +
-    `.policy details{margin-top:28px}.policy summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600;font-size:.875rem}` +
-    `.policy ol{list-style:none;padding:0;margin:0}.policy li{padding:10px 0;border-bottom:1px solid var(--border);font-size:.8125rem;overflow-wrap:anywhere}.policy li .what{display:block;font-size:.875rem}`;
-/** A ledger entry as one line of history: when, who, what, before → after. */
+import { disclose, facts, formRow, infoLine, note, notice, radios, settingsRecord, settingsSection, textarea } from "./server/kit.js";
+import { kitSectionForm } from "./settings-kit.js";
+/** The old look; the page is built from the kit now. Kept for chrome.ts, which still concatenates it. */
+export const POLICY_CSS = "";
+/** A ledger entry as one record of history: what, before → after; who; when. */
 function historyItem(entry) {
     const what = entry.action.replace(/^organisation policy: /, "");
     const [before, after] = (entry.detail ?? "").split(" → ");
-    return html `<li><span class="what">${what.charAt(0).toUpperCase() + what.slice(1)}: ${before ?? ""} → <strong>${after ?? ""}</strong></span><span class="meta">${entry.actor} · ${whenUtc(entry.at)}</span></li>`;
+    return settingsRecord({ title: html `${what.charAt(0).toUpperCase() + what.slice(1)}: ${before ?? ""} → <b>${after ?? ""}</b>`, sub: entry.actor, when: whenUtc(entry.at) });
 }
-export function policyHtml(view, notice) {
-    const note = notice.problem ? html `<p class="problem" role="alert">${notice.problem}</p>` : notice.said ? html `<p role="status">${notice.said}</p>` : "";
+export function policyHtml(view, outcome) {
+    const answer = outcome.problem ? notice(outcome.problem) : outcome.said ? infoLine(outcome.said) : "";
     const parts = policyParts(view.policy);
-    const changed = view.policy.updatedBy === null ? "" : html `<p class="meta">Changed by ${view.policy.updatedBy} on ${(view.policy.updatedAt ?? "").slice(0, 10)}.</p>`;
-    const current = html `<dl><dt>Providers</dt><dd>${parts.providers === "any" ? "Any" : parts.providers}</dd><dt>Models</dt><dd>${parts.models === "any" ? "Any" : parts.models}</dd><dt>Tools</dt><dd>${parts.tools === "any" ? "Any" : parts.tools}</dd><dt>Ceiling</dt><dd>${parts.ceiling}</dd></dl>${changed}`;
-    const history = view.history.length === 0 ? "" : html `<details><summary>History (${view.history.length})</summary><ol>${view.history.map(historyItem)}</ol></details>`;
-    if (!view.canChange)
-        return html `<section class="policy">${note}${current}<p class="meta">An instance operator sets the policy.</p>${history}</section>`;
-    const providers = POLICY_PROVIDERS.map(one => html `<label><input type="checkbox" name="provider" value="${one}"${view.policy.providers === null || view.policy.providers.includes(one) ? html ` checked` : ""}> ${PROVIDER_NAMES[one]}</label>`);
-    const levels = [...PERMISSION_LEVELS].reverse().map(level => html `<label class="choice"><input type="radio" name="ceiling" value="${level}"${view.policy.ceiling === level ? html ` checked` : ""}><span><strong>${LEVEL_NAMES[level]}</strong><small>${LEVEL_HINTS[level]}</small></span></label>`);
+    const changed = view.policy.updatedBy === null ? "" : ` · changed by ${view.policy.updatedBy} on ${(view.policy.updatedAt ?? "").slice(0, 10)}`;
+    const history = view.history.length === 0 ? "" : settingsSection({ id: "policy-history", title: "History",
+        body: disclose(`${view.history.length} ${view.history.length === 1 ? "change" : "changes"}`, joinHtml(view.history.map(historyItem))) });
+    if (!view.canChange) {
+        return joinHtml([answer, settingsSection({ id: "policy", title: "Organisation policy", state: changed, lead: "What every task may use, in every project.",
+                body: joinHtml([facts([["Providers", parts.providers === "any" ? "Any" : parts.providers], ["Models", parts.models === "any" ? "Any" : parts.models],
+                        ["Tools", parts.tools === "any" ? "Any" : parts.tools], ["Ceiling", parts.ceiling]]), note("An instance operator sets the policy.")]) }), history]);
+    }
+    const providers = html `<div class="k-checks" role="group" aria-label="Providers">${POLICY_PROVIDERS.map(one => html `<label for="policy-provider-${one}"><input type="checkbox" id="policy-provider-${one}" name="provider" value="${one}"${view.policy.providers === null || view.policy.providers.includes(one) ? html ` checked` : ""}> ${PROVIDER_NAMES[one]}</label>`)}</div>`;
     const toolHint = view.toolNames.length === 0 ? "" : ` Tools here: ${view.toolNames.slice(0, 12).join(", ")}${view.toolNames.length > 12 ? "…" : ""}.`;
-    return html `<section class="policy">${note}${changed}${postForm("/settings/policy", html `<fieldset><legend>Providers</legend><div class="providers">${providers}</div></fieldset><fieldset><legend><label for="policy-models">Models</label></legend><textarea id="policy-models" name="models" spellcheck="false" placeholder="Any model" aria-describedby="policy-models-hint">${(view.policy.models ?? []).join("\n")}</textarea><span class="hint" id="policy-models-hint">One per line; end with * to allow a family. Blank allows any.</span></fieldset><fieldset><legend><label for="policy-tools">Project tools</label></legend><textarea id="policy-tools" name="tools" spellcheck="false" placeholder="Any tool" aria-describedby="policy-tools-hint">${(view.policy.tools ?? []).join("\n")}</textarea><span class="hint" id="policy-tools-hint">One per line. Blank allows any.${toolHint}</span></fieldset><fieldset><legend>Permission ceiling</legend>${levels}</fieldset><div class="step-up">${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}</div><button type="submit">Save policy</button>`)}${history}</section>`;
+    return joinHtml([answer, settingsSection({ id: "policy", title: "Organisation policy", state: changed, lead: "What every task may use, in every project.",
+            body: kitSectionForm({ proof: "policy", action: "/settings/policy", id: "policy-form", gate: true, save: { label: "Save policy" }, confirm: "Change the policy",
+                body: joinHtml([
+                    formRow("Providers", "Work runs only on the ticked ones. All of them allows any.", providers, "wide"),
+                    formRow("Models", "One per line; end with * to allow a family. Blank allows any.", textarea({ id: "policy-models", name: "models", value: (view.policy.models ?? []).join("\n"), rows: 3, attrs: { spellcheck: "false", placeholder: "Any model", "aria-label": "Models" } }), "top"),
+                    formRow("Project tools", `One per line. Blank allows any.${toolHint}`, textarea({ id: "policy-tools", name: "tools", value: (view.policy.tools ?? []).join("\n"), rows: 3, attrs: { spellcheck: "false", placeholder: "Any tool", "aria-label": "Project tools" } }), "top"),
+                    formRow("Permission ceiling", "The most any task may be allowed to do.", radios({ name: "ceiling", legend: "Permission ceiling", current: view.policy.ceiling,
+                        items: [...PERMISSION_LEVELS].reverse().map(level => ({ value: level, label: LEVEL_NAMES[level], text: LEVEL_HINTS[level] })) }), "wide"),
+                ]) }) }), history]);
 }

package/dist/policy.d.ts

@@ -87,3 +87,6 @@ export declare function checkPolicy(input: {
     ok: false;
     problem: string;
 };
+/** The providers ticked on the policy form: every provider the policy knows ticked (and nothing unknown) means "any"
+ * (null), so a provider added later is allowed too; anything else is the list as ticked, for checkPolicy to check. */
+export declare function chosenProviders(chosen: readonly string[]): string[] | null;

package/dist/policy.js

@@ -224,7 +224,7 @@ export function checkPolicy(input) {
     if (input.providers !== null) {
         const unknown = input.providers.filter(one => policyProvider(one.toLowerCase()) === null);
         if (unknown.length > 0)
-            return { ok: false, problem: `${unknown.join(", ")} isn't a provider here. Choose from Claude, Codex, Gemini and OpenRouter.` };
+            return { ok: false, problem: `${unknown.join(", ")} isn't a provider here. Choose from ${providerChoices()}.` };
         providers = POLICY_PROVIDERS.filter(one => input.providers.some(given => policyProvider(given.toLowerCase()) === one));
         if (providers.length === 0)
             return { ok: false, problem: "Allow at least one provider, or allow any." };
@@ -248,3 +248,16 @@ export function checkPolicy(input) {
         return { ok: false, problem: tools.problem };
     return { ok: true, policy: { providers, models, tools, ceiling: input.ceiling } };
 }
+/** Every provider the policy knows, in plain names: "Claude, Codex, … and Goose". */
+function providerChoices() {
+    const names = POLICY_PROVIDERS.map(one => PROVIDER_NAMES[one]);
+    return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}
+/** The providers ticked on the policy form: every provider the policy knows ticked (and nothing unknown) means "any"
+ * (null), so a provider added later is allowed too; anything else is the list as ticked, for checkPolicy to check. */
+export function chosenProviders(chosen) {
+    const known = new Set(chosen.map(one => policyProvider(one.toLowerCase())));
+    if (known.has(null))
+        return [...chosen];
+    return POLICY_PROVIDERS.every(one => known.has(one)) ? null : [...chosen];
+}